RESOLVED FIXED293108
[scroll-animations] debug assertion hit under `JSCell::classInfo()` during document teardown when the last Document reference is dereferenced 
https://bugs.webkit.org/show_bug.cgi?id=293108
Summary [scroll-animations] debug assertion hit under `JSCell::classInfo()` during do...
Antoine Quint
Reported 2025-05-16 01:22:13 PDT
In case the document is torn down due to its last reference being dereferenced, we can hit this debug assertion under `JSCell::classInfo()` because we try to resolve the ready promise of a scroll-driven animation: ASSERT(vm().heap.mutatorState() != MutatorState::Sweeping || !vm().currentThreadIsHoldingAPILock());
Attachments
Add attachment proposed patch, testcase, etc.
Antoine Quint
Comment 1 2025-05-16 01:22:21 PDT
rdar://151306277
Antoine Quint
Comment 2 2025-05-16 01:54:01 PDT
Pull request: https://github.com/WebKit/WebKit/pull/45484
EWS
Comment 3 2025-05-16 10:03:55 PDT
Committed 295009@main (cdbbd6521df5): <https://commits.webkit.org/295009@main> Reviewed commits have been landed. Closing PR #45484 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.